{"record":{"id":"28a5ba8927814969","repo":"jackwener/OpenCLI","slug":"osv-dev-returned-no-record-for-id","errorCode":null,"errorMessage":"OSV.dev returned no record for \"${id}\".","messagePattern":"OSV\\.dev returned no record for \"(.+?)\"\\.","errorType":"exception","errorClass":"EmptyResultError","httpStatus":null,"severity":"warning","filePath":"clis/osv/vulnerability.js","lineNumber":29,"sourceCode":"    site: 'osv',\n    name: 'vulnerability',\n    access: 'read',\n    description: 'Single OSV.dev vulnerability detail (severity, affected packages, CVE/GHSA aliases)',\n    domain: 'osv.dev',\n    strategy: Strategy.PUBLIC,\n    browser: false,\n    args: [\n        { name: 'id', positional: true, type: 'string', required: true, help: 'OSV vulnerability id (e.g. \"GHSA-29mw-wpgm-hmr9\", \"CVE-2020-28500\")' },\n    ],\n    columns: [\n        'id', 'summary', 'severity', 'aliases', 'published', 'modified',\n        'affectedPackages', 'cwes', 'referenceCount', 'url',\n    ],\n    func: async (args) => {\n        const id = requireVulnId(args.id);\n        const vuln = await osvGet(`${OSV_BASE}/v1/vulns/${encodeURIComponent(id)}`, `osv vulnerability ${id}`);\n        if (!vuln || !vuln.id) {\n            throw new EmptyResultError('osv vulnerability', `OSV.dev returned no record for \"${id}\".`);\n        }\n        const affected = Array.isArray(vuln.affected) ? vuln.affected : [];\n        const pkgPairs = [];\n        for (const a of affected) {\n            const eco = a?.package?.ecosystem;\n            const name = a?.package?.name;\n            if (eco && name) pkgPairs.push(`${eco}:${name}`);\n        }\n        const aliases = Array.isArray(vuln.aliases) ? vuln.aliases.filter(Boolean) : [];\n        const cwes = Array.isArray(vuln?.database_specific?.cwe_ids) ? vuln.database_specific.cwe_ids : [];\n        const refs = Array.isArray(vuln.references) ? vuln.references : [];\n        return [{\n            id: String(vuln.id),\n            summary: String(vuln.summary ?? '').trim(),\n            severity: severityLabel(vuln),\n            aliases: aliases.join(', '),\n            published: trimDate(vuln.published),\n            modified: trimDate(vuln.modified),","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/osv/vulnerability.js#L11-L47","documentation":"The OSV vulnerability endpoint returned a 200 response whose body was empty or lacked an `id` field, so no usable record exists even though HTTP said OK. Thrown as EmptyResultError by the `vuln` command after osvGet succeeded.","triggerScenarios":"`vuln` called osvGet on `/v1/vulns/<id>`; requireVulnId passed but the parsed JSON was null/empty or missing `id` — e.g. the ID exists as an alias only, or OSV returned an empty/degenerate document.","commonSituations":"Querying an ID that OSV knows only as an alias of another record; a withdrawn advisory served with an empty body; an intermediary (proxy/cache) returning 200 with an empty or HTML body instead of JSON.","solutions":["Confirm the ID resolves on https://osv.dev/vulnerability/<id> in a browser","Try the alias ID (e.g. GHSA form of a CVE) — OSV sometimes serves records under the canonical ID only","Handle EmptyResultError gracefully and fall back to another advisory source (NVD, GitHub Advisory DB)","Check whether a proxy is corrupting the response body (200 with non-JSON content)"],"exampleFix":"// before\nconst v = await osvGet(`${OSV_BASE}/v1/vulns/${id}`, label); // may throw EmptyResultError\n// after\ntry { return await fetchVuln(id); }\ncatch (e) {\n  if (e instanceof EmptyResultError) return fetchFromNvd(id);\n  throw e;\n}","handlingStrategy":"fallback","validationCode":"if (!id || typeof id !== 'string' || !/^[A-Za-z]+-[A-Za-z0-9.-]+$/.test(id)) throw new Error(`Invalid vulnerability id: ${id}`);","typeGuard":"function isOsvVuln(v) { return v != null && typeof v === 'object' && typeof v.id === 'string' && v.id.length > 0; }","tryCatchPattern":"try {\n  const rec = await vuln(id);\n  return rec;\n} catch (e) {\n  if (/no record/i.test(e.message)) return nvdLookup(id) ?? ghsaLookup(id) ?? null;\n  throw e;\n}","preventionTips":["Prefer OSV-canonical IDs (GHSA/OSV) over alias IDs like CVE when known","Fall back to NVD or GitHub Advisory DB when OSV has no record","Verify uncertain IDs on osv.dev before batch lookups","Treat empty-but-200 responses as 'no data', not corruption"],"tags":["empty-result","api","osv"],"backgroundTag":"empty-api-response","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}